Some CTA turnstiles still tricked by federal IDs this morning

Catherine Garypie, at the Jackson Street Blue Line stop in the Loop, demonstrates how her federal identification badge triggers the Ventra system to allow her to go through the turnstiles without using a CTA Ventra card. (Chris Sweda, Chicago Tribune)

Catherine Garypie, at the Jackson Street Blue Line stop in the Loop, demonstrates how her federal identification badge triggers the Ventra system to allow her to go through the turnstiles without using a CTA Ventra card. (Chris Sweda, Chicago Tribune)

Ellen Jean Hirst and Jon HilkevitchTribune reporters

Some CTA riders could still get through turnstiles with a swipe of their federal IDs this morning as the agency worked to patch the software glitch.

The problem was discovered last week when an Environmental Protection Agency employee realized her federal ID card could trick Ventra fare readers at L turnstiles into giving her a free ride.

CTA spokesman Brian Steele said a software patch was completed Monday evening, tested overnight and was being rolled out system-wide today. He could not say when the rollout would be finished.

Catherine Garypie and Suzanne King, both EPA employees, were granted access at the L turnstiles when they tested their federal ID cards by swiping them at Ventra readers this morning. They said they used their Ventra cards before going through.

Garypie discovered the glitch Thursday night when she inadvertently swiped her ID instead of her Ventra card, which she keeps in the same pocket of her bag. In a hurry, she walked through the gate. "There was nobody around, so I thought, well I'm in a hurry so I just went home," Garypie said. "I thought it must be a fluke."

After testing it again Friday morning, she told a CTA manager and her employer, the EPA, about the problem. The EPA sent employees an email, alerting them that their work IDs can sometimes trick the CTA's Ventra fare card system.

"Please be advised that intentional misuse of federal credentials is prohibited," the email read in part. "We are grateful to the EPA employee who reported this matter."

The federal ID card appeared to admit passage about 1 in every 10 swipes.

Steele said the issue with the EPA employee card is "the first time we have seen something like this. We don't believe there are any other instances out there.''

Cubic Transportation Systems Inc., the California company that developed and is managing Ventra for the CTA under a $454 million contract, finalized the software update Monday night, Steele said. Cubic will be held responsible for reimbursing the CTA for lost revenue from unpaid fares due to glitches with the Ventra system, he added.

The issue marks the latest glitch since the CTA rolled out Ventra. Customer problems included difficulty activating Ventra cards, fare overcharges and poor customer service that have frustrated commuters since the general phase-in of Ventra began Sept. 9.

Ventra marks the transition to an open-fare payment system, in which any credit or debit card with "contactless,'' or radio frequency identification, technology can be used to pay fares on the CTA and Pace.

Under the CTA's old fare-collection system that will be retired soon, the only smart cards accepted are Chicago Cards and Chicago Card Plus cards. Those cards have performed well since their introduction in 2004.

Ventra cards are among the newest types of smart cards, outfitted with not only the radio frequency identification antenna but also a computer chip and a magnetic stripe. When a Ventra card is tapped on a Ventra reader aboard a bus or at a rail station turnstile, the reader receives information from the card and determines within 2.5 seconds whether the card is legitimate — either a Ventra card or a debit or credit card that has the radio frequency technology — and approves or denies entrance.

The Ventra card information is also sent to a computer system at a remote location to check the balance on the card and deduct the proper fare.

"In the vast majority of cases, the transaction occurs locally (on the Ventra reader),'' said Matt Cole, executive vice president of strategy and business development at Cubic. "There are a small number of exception cases where a further check to the back office needs to occur.''

He said that about every five minutes the Ventra system updates every reader — on all approximately 1,800 CTA buses, at the CTA's 145 rail stations and on all Pace buses.

Those checks are designed to detect any Ventra transactions that are suspicious, he said.

With employee work cards like Garypie's, which also have chips with identifying information, the internal processing number associated with the card is close enough to that of a credit or debit account that it can potentially trick the system, Steele said.

Invalid Ventra or credit or debit cards are supposed to be put on a "hot list" after they are used to prevent repeated access through the Ventra system, but Garypie was able to use her card on several occasions in a 24-hour period.

Other Ventra users have reported that they were able to use their Ventra cards to board buses and trains despite negative balances on their accounts — another indicator that Ventra's hot list doesn't catch everyone.

After receiving the email from the EPA, King decided to test it herself last Friday.

"I thought this must be a joke, so I tried it at the Adams and Wabash station," said King, a Green Line rider. After seven or eight tries, her federal ID worked, and it continued to allow access Tuesday morning.

Garypie said she tested her ID at several "L" stations but used her actual Ventra card before passing through the gate after Thursday's free pass. She said she'd be happy to pay the CTA back for the Thursday ride but has not heard from anyone with the agency, despite giving her contact information to a CTA manager.